How to Issue a Material Change Notice for Your NPP

NPP Generator Research Team · April 25, 2026 · 5 min read

HIPAA does not require you to redistribute your NPP on a schedule — only when it materially changes. But when a material change does occur, the obligations are specific: revise the NPP, update your website, and notify existing patients. Here's how to do it correctly.

What is a material change?

A change is "material" if it affects the substance of the notice — how PHI is used, what rights patients have, or who to contact. Common material changes:

• Adding a new use or disclosure of PHI (e.g., starting to participate in a health information exchange)
• Removing a patient right that was previously offered (e.g., eliminating an optional restriction right)
• Changing your Privacy Officer or their contact information
• Updating to a new regulatory model (e.g., HHS 2026 revision)
• A merger or acquisition that changes the covered entity's identity
• Adding Part 2 SUD language if your practice starts a Part 2 program

These are not material changes that require redistribution:

• Correcting a typographical error in a way that doesn't change the substance
• Updating a mailing address when the Privacy Officer contact information is otherwise unchanged
• Reformatting or redesigning the layout without changing the content

Is the 2013 → 2026 update a material change?

Yes. The HHS February 2026 revision was a material change to HIPAA NPP requirements. It integrated 42 CFR Part 2 SUD disclosure language and updated patient rights language across multiple sections. Any practice still using a pre-2026 NPP must update and redistribute to existing patients. See how to update to the 2026 model.

Step-by-step: issuing a material change notice

1. Revise the NPP. Update the substantive content that changed. Update the effective date to the date the new practices take effect. Include a supersede statement if replacing a prior version: "This Notice supersedes all prior versions effective [date]."
2. Update your website. Replace the old NPP link or page with the revised version. Do this on or before the effective date. For practices with multiple website pages linking to the NPP, ensure all links point to the new version.
3. Notify existing patients. Provide the revised NPP to patients with an ongoing treatment relationship. Options:
   • At next visit: include in intake paperwork or hand at check-in
   • By mail: send to patients with appointments or active care in the past 12 months
   • Electronically: via patient portal message with a link to the revised NPP; request an acknowledgment click
4. Document the notification. Record the date you updated the website, the method used to notify patients, and which patient population was notified. Retain this documentation for 6 years.

Who qualifies as an "existing patient" you must notify?

HIPAA requires notification to patients with an "ongoing relationship" — typically interpreted as patients who have received care within the past year or who have upcoming scheduled appointments. You are not required to contact every former patient who has had no contact in years. Practices with a patient portal can send a portal message to all active accounts; practices without should focus on patients with recent or upcoming appointments.

Supersede date: what to write

Include a supersede statement in the revised NPP header or footer:

Some practices include both dates for transparency: "Effective [new date], superseding the prior version dated [old date]." Either format is acceptable under HIPAA. See NPP effective date and supersede date for more detail.

Frequently Asked Questions